CVE-2025-6755 is a path traversal vulnerability (CWE-22) in the Game Users Share Buttons WordPress plugin affecting all versions up to and including 1.3.0. The ajaxDeleteTheme() function fails to properly validate the themeNameId parameter, allowing an attacker with Subscriber privileges to craft AJAX requests that include arbitrary file paths. This can lead to deletion of arbitrary files such as wp-config.php and potentially remote code execution. The vulnerability is remotely exploitable over the network without user interaction and requires low privileges.

Successful exploitation allows an attacker with Subscriber-level access to delete arbitrary files on the server, including critical configuration files. This can lead to denial of service or remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 8.8, indicating a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access and monitor for suspicious AJAX requests targeting the ajaxDeleteTheme() function. Avoid using the vulnerable plugin version in production environments.